Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
The vulnerability is classified as CWE-284 (Improper Access Control) and results from improper access control in WebLogic Server Proxy Plug-in components for Apache HTTP Server and IIS. An attacker with network access via HTTP can exploit the vulnerability without authentication and without user interaction. Exploitation causes a scope change, meaning the impact extends beyond the directly attacked component and may affect other related products.
An attacker can gain unauthorized full access to read critical data or all data available to Oracle HTTP Server and WebLogic Server Proxy Plug-in, as well as unauthorized creation, modification or deletion of critical data. The vulnerability affects both confidentiality and data integrity (both CVSS indicators at HIGH level).
Apply patches available from the vendor according to references — Oracle Critical Patch Update from January 2026 (https://www.oracle.com/security-alerts/cpujan2026.html). Due to the maximum CVSS score and lack of prerequisites on the attacker's side, the update should be performed immediately.
Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Note: for WebLogic Server Proxy Plug-in for IIS, the vulnerability affects only version 12.2.1.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NOracle HTTP Server
APPOracle12.2.1.4.014.1.1.0.014.1.2.0.0Oracle Weblogic Server Proxy Plug In
APPOracle12.2.1.4.014.1.1.0.014.1.2.0.0
Related vulnerabilities
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot...
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before ...
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding...
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an ...
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory...